Privacy policy

Last updated: 2026-10-28

Who is responsible

The data controller is Alexandru Cojocaru, Italy. Contact: hi@xojoc.pw.

Without an account

• No cookies for statistics or advertising. Visits are counted with Plausible Analytics, running on our own server: it uses no cookies and keeps only aggregated numbers (pages, referrers, countries, devices), never a profile of you.
• Like every web server, ours records technical logs (IP address, page, browser, time) to keep the site running and secure. They rotate automatically and are kept for a few days at most.
• To slow down abuse, failed logins, sign-ups and emails are counted per IP address, stored only as a one-way hash and deleted after at most one hour.
• Card images are loaded directly from the servers of Scryfall: your browser sends them your IP address, as for any image on the web.

With an account

• Username, email address, password (stored only as a hash) and the date you joined: to let you log in and to send the emails you ask for (account confirmation, password reset).
• Your saved decks, followed formats and simulator settings.
• Simulator games: decks, results and rating. Your username is shown to your opponents and on the leaderboard.
• Replays and chat messages of a game are deleted 60 days after the game ends.
• Accounts never confirmed are deleted after 7 days.

You can delete your account at any time from your page: your decks, ratings, replays and chat messages are deleted with it. Finished games stay in your opponents' history, with the name you had at the table but no link to an account.

Cookies and browser storage

Only technical cookies, needed for the site to work, so no consent is required:

• sessionid: keeps you logged in (only after you log in).
• csrftoken: protects forms from requests sent by other sites.

The browser's local storage keeps the layout of the game table, whether you have seen the table help, and recently visited pages for the back button. This stays on your device.

Why we can use the data

• Account, decks and games: to provide the service you sign up for (contract).
• Logs, abuse limits, error reports and visit statistics: our legitimate interest in a secure, working site.

Who else handles the data

• The hosting provider of our servers, and our email provider for the emails we send you.
• Sentry (Functional Software, Inc.): reports of technical errors, without IP addresses, accounts or cookies.
• Scryfall: card images, as described above.

We never sell personal data. Database backups are kept on our server for 14 days.

Your rights

You can ask to access, correct, delete or receive a copy of your data, or object to its use, by writing to hi@xojoc.pw. You can also lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali).